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The growth of e-commerce is creating 
demand for services with financial incentives 
for service providers. Such services are 
specified by service level agreements (SLAs) 
in which revenue accrues with the number of 
completed transactions, and costs are 
incurred if response times go above a 
specified threshold. In this paper we propose 
a profit-oriented feedback control system that 
automates the admission control decisions in 
a way that balances the loss of revenue due 
to rejected work against the penalties 
incurred if admitted work has excessive 
response times. One approach to making 
these trade-offs is to employ classical control 
theory (e.g., proportional integral controllers); 
however, doing so requires a labor-intensive 
design process that tailors the controller to a 
specific workload and profit model. Instead, 
we develop a fuzzy control algorithm that 
implements hill climbing logic to maximize 
profits and handle the stochastics that make 
profits quite “bumpy.” Our studies of a Lotus 
Notes® e-mail server reveal that the fuzzy 
controller requires little human intervention 
and is robust to changes in workloads and 
values of SLA parameters. Further, we prove 
that our design of the fuzzy controller leads to 
a value of the admission control parameter 
that maximizes steady state profits. 


The advent of e-commerce has created a business 
need for high-quality information technology (it) 
services. For example, a “buy” transaction that takes 
more than a few seconds may cause the customer to 


abandon the purchase. As a result, businesses are 
seeking quality-of-service (QoS) guarantees from 
their service providers (SPs). These guarantees are 
expressed as part of service level agreements (SLAs), 
often with financial incentives. For example, provider 
revenues may be determined by the number of com¬ 
pleted transactions, and providers may incur finan¬ 
cial penalties for SLA violations (e.g., exceeding re¬ 
sponse time guarantees). Since demand for services 
is often unpredictable, providers must sometimes 
make trade-offs between losing revenue (e.g., as a 
result of admission control that denies access to some 
customers) and incurring penalties (e.g., because 
admitted work cannot be completed within the 
SLA-dictated response time). Making such choices 
is skill-intensive and time-consuming, and the deci¬ 
sions must be made in real time. In this paper we 
focus on QoS at the application layer, as opposed to 
the network-level QoS considered in the work on 
DIFFSERV and RSVP. 1 

A variety of SLAs have been published. Reference 
2 describes a template for frame relay SLAs. Refer¬ 
ence 3 provides guidelines for the state of Texas, in¬ 
cluding considerations for response time, availabil¬ 
ity, and downtime. Reference 4 does the same for 
the University of Michigan IT. We generalize these 
examples and consider a simple profit model in 
which: (A) the service provider receives revenues for 
each completed interaction (hereafter, transaction) 
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Figure 1 Profit-based feedback in a hand-crafted PI controller for a Lotus Notes e-mail server 
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and (B) a cost is incurred if response times are ex¬ 
cessive. The profit model is described by three pa¬ 
rameters: (1) r, the revenue received for each 
completed transaction; (2) W, the response time con¬ 
straint; and (3) c , the cost incurred if a transaction’s 
response time exceeds W (offending transactions). 
Thus, profit is determined by the number of com¬ 
pleted transactions and the number of offending 
transactions as follows: 

Revenue = r * (number of completed transactions) 
Cost = c * (number of responses that take 

longer than W) 

Profit = Revenue — cost 

Diao et al. 5 describe this and other profit models in 
more detail, including generalizations to multiple 


classes by subscripting r, W, and c to make them per- 
class variables. As the first step toward building an 
intelligent controller for service management, the 
profit model presented above is deliberately simple. 
By no means does this profit model capture all di¬ 
mensions of QoS. In particular, we ignore any explicit 
terms related to rejected requests. The rejection 
scheme is implicitly considered in the above profit 
model as a combination of lost revenue (the trans¬ 
action request is not admitted) and cost of penalty 
(cost of offending transactions). 

SLA enforcement requires a control infrastructure, 
much of which consists of feedback loops. For ex¬ 
ample, the lower portion of Figure 1 displays a feed¬ 
back loop for controlling response times in a Lotus 
Notes* e-mail server (the upper portion describes 
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how to manually design the controller and is dis¬ 
cussed in the section on profit-based proportional 
integral [pi] controller design). Mail users interact 
with the server to retrieve, browse, catalog, and send 
their mail. Administrators specify policies in the form 
of desired response times. The difference between 
the reference value and measured response times is 
the control error. This is used by the controller to 
compute the setting of MaxUsers , which is the limit 
on the number of users allowed to connect to a Notes 
application. Note that some desired feedback ele¬ 
ments (such as end-user response time) are user-ori¬ 
ented metrics, which may be difficult for the SP to 
obtain. However, they can be estimated from some 
server-side measurements or by using client-side 
probing stations. 

Feedback loops have been widely studied; typically, 
they are analyzed in terms of stability, steady state 
error, and transient response 6 (usually characterized 
by rise time, overshoot, and settling time). Our in¬ 
terest is in a business-oriented analysis, in particu¬ 
lar how to design controllers that maximize SLA prof¬ 
its. More specifically related to our work, Reference 

7 describes an implementation that manages Web 
server resources based on maximizing revenue (e.g., 
responding within 8 seconds so that users are not 
discouraged). However, they do not study the char¬ 
acteristics of control actions that are preferred, nor 
is the choice of profit model considered. Reference 

8 describes a system that performs on-line optimi¬ 
zation of a Web server by using hill climbing tech¬ 
niques. However, the approach taken requires a de¬ 
tailed knowledge of the system being optimized in 
order to construct the queueing models. Reference 

9 considers the optimization problem of maximiz¬ 
ing the SLA profits based on queueing-theoretic for¬ 
mulas, but the proposed scheme does not incorpo¬ 
rate feedback, which makes it less adaptable in the 
presence of time-varying workloads (quite common 
in e-commerce systems). Others (e.g., References 
10-12) have studied the performance characteris¬ 
tics of feedback controllers used for resource man¬ 
agement, and much work has been done on pricing 
models for information systems, such as pricing band¬ 
width and transactions (e.g., References 13, 14). In 
those studies, however, the connection to profitabil¬ 
ity through SLAs is missing and so the derivation of 
the controller characteristics that maximize profits 
is not addressed. 

Fuzzy control has been an active area of research as 
well. 15 Reference 16 uses fuzzy methods to solve the 
job scheduling problems. Reference 17 applies fuzzy 


logic to some multimedia applications where the in¬ 
formation, be it sound, image, or text, is not precisely 
specified. Others have applied fuzzy techniques to 
profit maximization: Reference 18 addresses bank 
credit granting, while Reference 19 addresses profit 
maximization for decision support. (But neither ad¬ 
dresses profit optimization in the context of feed¬ 
back control.) Most closely related to our study is 
Reference 20, which derives fuzzy control laws to 
maximize the profit of a simple queueing system. Al¬ 
though this is a step toward profit-maximizing feed¬ 
back control of computing systems, the results are 
specific to GI/M/1 tandem queues and require prior 
knowledge of arrival rates. 

We are interested in a general way of constructing 
profit-maximizing feedback loops that do not rely 
heavily on prior knowledge about the target system. 
One approach is to use classical control theory to 
design feedback loops that maximize profits. We de¬ 
scribe below experiments in which a fast proportional 
integral (pi) controller (one with short settling times) 
generates increased profits. Unfortunately, consid¬ 
erable skill is required to design good PI controllers, 
and this runs counter to the trend toward autonomic 
computing in which computing systems are self-op¬ 
timizing. 21 

Herein, we propose a feedback control system that 
directly optimizes profits and is robust to changes in 
workloads, the target system (the system in which it 
is used), and the underlying service level agreement 
(although the last does need to be reflected in the 
feedback loop). A fuzzy controller is employed to 
construct a profit-maximizing feedback loop, which 
avoids skill-intensive alternatives such as building a 
specific queueing model or handcrafting a PI con¬ 
troller. Our approach is based on the nature of cost 
and revenue curves. In particular, we show that un¬ 
der some reasonable assumptions for a Lotus Notes 
e-mail server, profits are concave downward in the 
control parameter (MaxUsers). We construct a fuzzy 
controller that employs hill climbing to maximize 
steady-state profits. This approach provides a con¬ 
venient way to separate the logic of hill climbing (as 
expressed in fuzzy rules) from the calculation of new 
values of MaxUsers (as represented by the member¬ 
ship functions). Such a separation is desirable in or¬ 
der to deal with resident stochastic processes and 
the resulting increase in the variability of the on-line 
profit measurement. We use a Lyapunov analysis to 
prove that the proposed fuzzy controller leads to the 
maximum profit at steady state. 
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Figure 2 High-level description of Lotus Notes e-mail server with admission control 
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The handcrafted PI controller requires human in¬ 
volvement to select control gains and reference val¬ 
ues for specific profit models (values of W, r, and 
c ) and workloads. In contrast, the profit-based fuzzy 
control does not require human intervention when 
the profit model or workload changes. Although 
mechanisms must be in place to communicate 
changes in the profit model to the controller, chang¬ 
ing the profit model does not require a controller 
redesign to get good performance. Thus, using fuzzy 
control may be more economical to employ in prac¬ 
tice. 

The remainder of the paper is organized as follows. 
The next section describes how a PI controller can 
be handcrafted for a specific workload and profit 
model. The following section details the architecture 
and fuzzy rules used in the feedback loop that we 
propose and provides comparisons with the hand¬ 
crafted approach. The section after that proves that 
our fuzzy rules cause the controller to converge 
toward an operating point with maximum profit in 
steady state. Our conclusions are contained in the 
final section. 


Handcrafted PI control 

In this section we describe a manual approach to con¬ 
structing controllers that aim to maximize profits. We 
begin by describing the Lotus Notes system and its 
behavior for a static value of MaxUsers, a situation 
referred to as open-loop control. For additional de¬ 
tails see Reference 5. 

Open-loop control. We begin with a high-level de¬ 
scription of the Lotus Notes e-mail system. The struc¬ 
ture of this system is displayed in Figure 2. Potential 
users must pass through admission control, which is 
gated by the MaxUsers parameter. Once admitted, 
users cycle through two states: (1) thinking and (2) 
waiting for a response to an RPC (remote procedure 
call) submitted to the Notes server. Admission con¬ 
trol rejects users if the number of users already 
present in the system is greater than or equal to Max- 
Users. The details here are a bit more involved since 
admission control is exercised only for OpenDB RPCs, 
and subsequent RPCs from the same user will bypass 
the admission control scheme and enter the RPC 
queue directly. 10 Once admitted to the Notes sys- 
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tern, users remain for the duration of their session, 
and the admission controller does not force admit¬ 
ted users to log off, nor does it know if a user logs 
off by itself. This certainly affects the effectiveness 
of the admission control scheme (e.g., there may ex¬ 
ist a delay between the decrease of the tuning pa¬ 
rameter MaxUsers and the decrease of the number 
of actual served sessions). We have implemented a 
simulator to model the above Notes mechanism, 
which produces accurate values of response times 
and transaction completions, typically within 1 per¬ 
cent of the real system, 22 at least for standard bench¬ 
marks. 

Now consider the profits of a Lotus Notes system in 
which MaxUsers is static. We use a time-varying 
workload that mixes low and high workloads (the 
workload is defined as the reciprocal of the average 
user think times) as follows: Period 1 (low workload) 
covers interval 1-2 hours and has think time 10 sec¬ 
onds; Period 2 (high workload) covers interval 2-4 
hours and has think time 3 seconds; Period 3 (low 
workload) covers interval 4-6 hours and has think 
time 10 seconds. We also define three profit models 
P(l), P{ 2), and P(3) with different values for pa¬ 
rameters r and c. P(l): r = c, that is, assigns equal 
weights to completed and offending transactions; 
P( 2): r = 5c, assigns more weight to completed 
transactions; P( 3): r = c/5, assigns more weight to 
offending transactions. Generally, our studies show 
that we may not select a static value of MaxUsers 
that is suitable for the whole mixed low-high work¬ 
load, as this static value will be a compromise be¬ 
tween the low workload and the high workload. In 
particular, during light loads, response times may 
rarely exceed W. Although this reduces costs, it also 
means that we might be able to increase profits by 
having a larger MaxUsers during light loads, since 
doing so would increase completions (and hence rev¬ 
enue) faster than it would increase response time 
violations (and hence costs). Conversely, during the 
heavy load, response times are mostly violated, and 
so having a smaller value of MaxUsers can increase 
profits. This example suggests that profits could be 
increased by dynamically adjusting MaxUsers in re¬ 
sponse to changes in workload. 

Profit-based PI controller design. When designing 
feedback controllers we try to ensure stability and 
to provide desirable characteristics. Here, we focus 
on a simple but widely used class of controllers, with 
PI control and good performance specifications (i.e., 
quick convergence, zero steady-state error). PI con¬ 
trollers compute the value of the tuning control as 


/ 


u(k) =K f 


e(k) + 


\ 


1 k ~ l \ 

T S e(j) 

; /=i / 



where u{k) is the output of the controller (the tun¬ 
ing control) and e{k) is the control error (difference 
between the reference value and the measured value 
of the controlled metric) for the k th time interval. 
Intuitively, the adjustment of the tuning control de¬ 
pends on the current value of e(k) and the sum of 
past e(k) values. Their effects on the tuning control 
are weighed by the proportional control gain K P for 
the response to system disturbances (e.g., workload 
variations) and the integral control time constant T 7 
for eliminating the steady-state error. Designing a 
PI controller means properly specifying K P and T) 
so as to eliminate the steady-state error with certain 
convergence speed. 23 

One way to design a profit-based PI controller is to 
explore the space of controller parameters using 
models and then evaluate the most promising con¬ 
trollers on the target system (Lotus Notes, in our 
case). As illustrated in the upper portion of Figure 
1, we first use system identification techniques to con¬ 
struct system models which are in the form of first 
order difference equations 

y(k + 1) = ay(k) + bu(k) (2) 

where u(k) is the offset value of MaxUsers andy(/c) 
is the offset value of response time (the offset is the 
difference between the measured value and the op¬ 
erating point, obtained by averaging the collected 
data). The model parameters a and b are estimated 
using the least squares method. 10 Although quite 
simple, it turns out that this model can account for 
88 percent of the variability in response times in our 
detailed simulation of Lotus Notes. Similarly, we 
have also built a first order model from MaxUsers 
to completed transaction. A good fit is obtained for 
completions as well. 

The next step is to design the controller by properly 
selecting the control gains. This is done by employ¬ 
ing the models just described. Using Equation 2, we 
study nine controllers defined by K P E {0.2, 2, 20} 
in combination with Tj E {2, 10, 200}. Figure 3 
displays the modeled response times of these con¬ 
trols when they are perturbed by both an increase 
and a decrease in MaxUsers at 200 and 300 minutes, 
respectively. (We use this perturbation to simulate 
workload variation.) The v-axis is time, and the y- 
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Figure 3 Comparison of transient response using first-order models with reference value 1 
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(DSOM’Ol), Nancy, France, October 2001, IEEE, New York (© 2001 IEEE). 


axis is response time. The dotted line is the refer¬ 
ence value of response time. The nine combinations 
of K P ,Tj are arranged in a matrix of plots with rows 
having the same T 7 and columns having the same 
K P . We see that the controllers can be separated into 
three groups. Controllers 2, 3, and 6 are unstable, 
as can be seen by the large scale of they-axis. Con¬ 
trollers 4,7, and 8 have fairly long settling times (es¬ 
pecially controller 7) compared with controllers 1, 
5, and 9. We refer to the former as slow controllers 
and the latter as fast controllers. Generally, we pre¬ 


fer fast controllers because they are able to quickly 
compensate for the disturbance so as to maintain 
proper response time regardless of workload vari¬ 
ation. 

The final step is to evaluate the designed controller 
and to specify the reference values. Generally, faster 
controllers (i.e., 1,5,9) consistently have the largest 
profits. Profits for controllers 2,3, and 6 are the low¬ 
est because they are unstable. Also, the slow con¬ 
trollers 4, 7, and 8 do not generate high profits since 
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their long settling times either indicates losing rev¬ 
enue (if they fail to respond to lower workloads by 
rapidly increasing MaxUsers) or incurring extra costs 
(if they fail to decrease MaxUsers fast enough for 
higher workloads). Also note that the choice of the 
reference value has large impact on the profit, and 
it is affected by the profit model parameters. Gen¬ 
erally, this is a trial and error process following the 
rule of thumb that a larger reference value is desired 
for the profit model more favorable to the revenues, 
but a smaller reference value is needed if the cost 
of violating SLAs is dominant (additional details can 
be found in Reference 5). 

We draw two insights from the foregoing. First, fast 
controllers with short settling times (e.g., controller 
5) consistently result in higher profits. Second, man¬ 
ual construction of a profit-based PI controller is 
time-consuming and skill-intensive. Specifically, the 
manual approach requires steps for: (1) model build¬ 
ing, (2) model-based parameter exploration, and (3) 
detailed studies of selected controllers with differ¬ 
ent reference value settings. In the next section, we 
show how much of this manual burden is alleviated 
by using a fuzzy control approach. 

Fuzzy controller 

Fuzzy control provides a means for expressing con¬ 
trol laws as high-level rules. Using fuzzy rules for 
profit maximization can both simplify the controller 
design (no need for building the model and spec¬ 
ifying the reference value) and make it more robust 
to the variations in workloads and profit models. In 
this section we describe and evaluate a fuzzy con¬ 
troller we developed for the Lotus Notes simulator 
described in the previous section. 

Profit model structure. In the next section we de¬ 
scribe the design of the fuzzy controller. That de¬ 
sign is based on certain properties of the profit model 
structure that will be the focus of this section. Spe¬ 
cifically, we show that profit is a concave downward 
function of MaxUsers, if offered load is sufficiently 
heavy (so that MaxUsers always has an effect). Since 
we are concerned with steady state, we assume that 
MaxUsers remains constant for a sufficiently long 
time so that transient effects are minimal. 

We begin with the number of transactions that vi¬ 
olate the response time constraint. Let f(u) be the 
number of violating transactions when MaxUsers = 
u. Further, let f(u) be the derivative of/with re¬ 
spect to u , and f"(u) be the second derivative. We 


Figure 4 Illustrating the properties of the profit model 



MAXUSERS (u) 


c PROFIT (h) 



U w MAXUSERS (u) 


intuitively infer the properties of/, /', /" by exam¬ 
ining common queueing curves. In particular, we as¬ 
sume the following: 

(A) /(0) = 0 (i.e., if we do not admit any transac¬ 
tions, we cannot have violations of response 
time constraints) 

(B) f'(u) ^ 0 (i.e., we get more violations as Max- 
Users increases), with/'(0) = 0 

(C) f"(u ) > 0 in that the rate at which violations 
increase grows as MaxUsers increases. The rate 
of increase is small for low values of MaxUsers 
since resource contention is low and the prob¬ 
ability of a violation is small. However, the prob¬ 
ability of a violation grows rapidly as MaxUsers 
increases. 

Let v(u) be the cost incurred by operating the server 
at MaxUsers = u. This is v(u) = cf(u ), where c > 
0. Since/has the above properties, so does v. This 
is depicted in Figure 4A. 

We can do a similar analysis for completions and rev¬ 
enue. Let g(u) be the number of completions if Max- 
Users = u. Clearly, 

(D) gr(0) = 0 (i.e., no admissions means no com¬ 
pletions) 
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(E) g'(u ) > 0 (i.e., more admissions lead to more 
completions), and ^'(0) > 0 (going from no 
admissions to a positive number, the number 
of completions can only go up). The latter does 
assume that there is no thrashing, such as oc¬ 
curs in resource constrained virtual memory sys¬ 
tems. 

Things are a bit different for g"(u). As MaxUsers 
grows large, resource bottlenecks occur that place 
an upper limit on throughput. When u is small, g ' ( u ) 
increases rapidly since all offered load becomes car¬ 
ried load. However, for larger u , there are periods 
in which resources are saturated and so additional 
offered load does not translate into more carried 
load. Thus, the rate at which g r (u) increases begins 
to slow. Put differently, 

(F) g"(u) < 0 

Let w(u) be the revenue incurred when MaxUsers = 
u. Then ,w(u) = rg(u), wherer > 0. Thus, the prop¬ 
erties (D), (E), and (F) also apply to w(u). This is 
depicted in Figure 4B. 

Now consider profit. Define h(u) to be the profit at 
u. Then, h(u ) = w(u) - v(u). We consider a sit¬ 
uation in which for large u, v f (u) > w'(u ), 24 which 
is consistent with Figure 4. With this and if costs abide 
by (A), (B), and (C) above and revenues abide by 
(D), (E), and (F) above, then profits are concave 
downward. 

To prove this claim, note that h'(u) = w'(u) - 
v'(u). Since vr'(0) > 0 and U(0) = 0, we have 
/T(0) > 0. Also, since t/(oo) > w'(oo), we have 
h ' (o°) < 0. Thus, if h' (u) is continuous, there exists 
u 0 such that h f (u 0 ) = 0. Moreover, note that 
h"(u) = w"(u) - v"(u) < 0 (since w"{u) < 0 and 
v"(u) > 0). Hence, u 0 is a unique maximum point. 

Note that at very large values of u, /' (u) = 0 since 
resource bottlenecks limit the number of transactions 
and hence the number of offending transactions. 
Therefore, the above analysis is only valid locally and 
/E(oo) < 0 only stands for large enough u; profit is 
locally concave downward. 

How do the foregoing relate to data we obtain from 
the Notes simulations? Figure 5 shows the cumula¬ 
tive profit for the profit models P(l)-P(3) as be¬ 
fore in combination with light and heavy workloads. 
All the profit curves are concave downward, except 
under a high workload. Here, MaxUsers is large and 


so profits are flat due to the saturation of the server 
and the limited number of arriving users. Note that 
the profit shown is accumulated over an interval of 
5 hours for Figure 5 to clearly view the trend of prof¬ 
its. Also note that the optimal MaxUsers values for 
the maximum profit are quite different for different 
workloads. This motivates dynamic profit optimiza¬ 
tion since a fixed MaxUsers selected offline may not 
be proper when the workload is changing (similarly 
for the change of profit models). 

Controller design. In this section, we describe the 
high-level architecture of our fuzzy control system 
and how it differs from the PI controller introduced 
before. Next, we discuss how the controller is de¬ 
signed to exploit the profit model structure derived 
above, and how it is able to handle stochastics in the 
feedback. Finally, we evaluate our controller for ef¬ 
ficiency and robustness, using a well-tuned PI con¬ 
troller as a baseline. 

Controller architecture. The architecture of our pro¬ 
posed fuzzy control system is shown in Figure 6. Just 
like the PI controller, we define a sampling interval 
that dictates how often actions are taken. The feed¬ 
back loop includes a profit model component (up¬ 
per right) that computes the profit for each interval. 
Note that the inputs for computing the profit are the 
throughput (completed transactions) and response 
time. To get the actual values may be difficult. How¬ 
ever, they can be estimated from the server-side mea¬ 
surements or client-side probing stations. Also note 
that we compute and maximize the profit based on 
intervals. By having a long enough interval we en¬ 
sure that the measured interval profit is repre¬ 
sentative. Also, this interval is not too long, so that 
the controller can adapt quickly to changes in the 
operating environment. The next component on the 
feedback path is a differentiator, which outputs the 
change in profit value (dy) between the current in¬ 
terval and the last. The other element of the feed¬ 
back is the change in MaxUsers value (du). As we 
show below, it is more convenient for the controller 
to work with du and dy rather than the original val¬ 
ues. The output of the controller is m, an adjustment 
to MaxUsers for the next time interval. An integra¬ 
tor element converts this delta into an actual Max- 
Users value for the Notes server. The internals of 
the controller are described in the next section. 

This profit-based fuzzy controller in Figure 6 differs 
in substantial ways from the PI controller depicted 
in Figure 1. Specifically, the PI controller regulates 
to a desired response time by having an expert care- 
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Figure 5 Profit shapes for the Notes server 



fully choose the controller parameters through ex¬ 
tensive off-line analysis of the target system (the 
Notes server) and the profit model. This work may 
have to be redone if there are changes in the work¬ 
load, the target system (e.g., a software upgrade), or 
the profit model. Indeed, we expect that profit mod¬ 
els will change frequently due to negotiations of SLA 
agreements that change the revenues (r) to service 
providers, the costs of service level violations (c), 
and the negotiated response time constraints ( W ). 
In contrast, the fuzzy controller incorporates the 
profit model as an element of the feedback loop. 
Such a design allows the controller to adjust auto¬ 
matically to changes in the workload, the target sys¬ 
tem, and even the profit model. 


Controller components. As mentioned earlier, the 
fuzzy controller’s actions are guided by a set of fuzzy 
rules. The rules are stored in a rule database (or rule 
base), which is part of the controller. These rules are 
generally if-then rules defined in terms of linguis¬ 
tic variables, which are different from the numerical 
input-or-output variables of the controller. As we dis¬ 
cuss below, these linguistic variables are a natural 
way to handle uncertainties created by the stochas¬ 
tics present in most computer systems. 

Linguistic variables exist in one-to-one correspon¬ 
dence with some numeric variable of the system. For 
example, change-in-MaxUsers is a linguistic variable 
corresponding to the numeric variable for the actual 
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Figure 6 Architecture of the profit-based fuzzy controller 
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change in the MaxUsers value. (Similarly for change- 
in-profit and next-change-in-MaxUsers.) A linguistic 
variable takes on linguistic values, such as poslarge 
and neglarge. (Note that neglarge is generally used in 
fuzzy control literature as an abbreviation for “neg¬ 
ative large in size” and so on for others such as pos¬ 
large or possmall.) Linguistic variables actually take 
on a “degree of truth” for each possible linguistic 
value. This is represented as a continuous value be¬ 
tween 0 to 1 where 0 is false, 1 is true, and 0.5 in¬ 
dicates we are halfway certain. The mapping from 
a numeric value to a degree of truth for a linguistic 
value is done by the membership function p. 

We use triangular membership functions, 25 as shown 
in Figure 7, to map from the numeric variables (the 


change of MaxUsers value ( du ), the change of the 
profit (dy), and the expected change of the Max- 
Users as the next step (m)), to the linguistic vari¬ 
ables (change-in-MaxUsers, change-in-profit , and 
next-change-in-MaxUsers , respectively). They-axis in¬ 
dicates the degree of truth for each of the linguistic 
values neglarge and poslarge. For example, du = 0.5 
maps to 0.75 for poslarge and 0.25 for neglarge. 

Note that the measured variables are normalized be¬ 
fore applying the mapping function, which is why the 
v-axis shows -1 and 1 for all the membership func¬ 
tions. This is done by multiplying the measured nu¬ 
meric quantities by factors known as the normaliz¬ 
ing gains, and denoted g du and g dy . For example, in 
the membership function shown in Figure 7, we 
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Figure 7 Membership functions and fuzzy inference 



would like that change-in-MaxUsers map to poslarge 
if it is larger than 1. For example, if g du = 1/10, 
change-in-MaxUsers is poslarge if 10 more users are 
allowed to enter. 

Due to the stochastic nature of computing systems, 
the on-line internalized profit feedback will contain 
significant variability, particularly when the sample 
intervals are short. Hence, there is some uncertainty 
as to how much of the change in profit from one in¬ 
terval to the next is caused by the setting of Max- 
Users and how much is due to stochastics. Fuzzy set 
theory provides a natural way to handle such sto¬ 
chastic data, by using the normalizing gains and 
membership functions to characterize these uncer¬ 
tainties (as shown in Figure 7 between -1 and 1). 
In the example above, the mapping of du = 0.5 in¬ 
dicates that we are more certain (0.75) that the “ac¬ 
tual” value of du is positive large than negative large 
(0.25). 

The fuzzification component of the controller (bot¬ 
tom of Figure 6) implements the membership func¬ 
tions p discussed above and converts the input nu¬ 
merical variables to their linguistic equivalents. Fuzzy 
inference involves the evaluation of the fuzzy rules 
in the rule set and combining the actions of rules 
(the THEN parts) to yield an output in terms of a lin¬ 
guistic variable. For details of fuzzy inference, please 
refer to a standard text on fuzzy control (e.g., Ref¬ 
erence 15). The defuzzification component is com¬ 
plementary to fuzzification and converts the output 
linguistic variable to a numerical value. 

Since the concave-downward shape of the profit 
model implies that there is an optimal value of Max- 
Users, which we denote by u 0 , that maximizes prof¬ 
its, we next describe a fuzzy rule set that implements 
a hill-climbing procedure to find this optimal value. 


The fuzzy rules are easy to design based on our in¬ 
tuitive understanding of hill climbing. Thus, if the 
current MaxUsers is to the left of the optimal value, 
we would want to increase MaxUsers in order to in¬ 
crease profits. However, since the optimal value is 
not known, the fuzzy rules must first determine 
whether we are to the left or to the right of the Max- 
Users that maximizes profits. Moreover, we must ad¬ 
just MaxUsers in appropriate increments since too 
small a change will cause slow convergence, whereas 
too large a step may cause oscillation. The follow¬ 
ing four rules are given to address these issues. 

Rule 1: IF change-in-MaxUsers is neglarge AND 
change-in-profit is neglarge THEN next- 
change-in -MaxUsers is poslarge. 

Rule 2: IF change-in-MaxUsers is neglarge AND 
change-in-profit is poslarge THEN next- 
change-in -MaxUsers is neglarge. 

Rule 3: IF change-in-MaxUsers is poslarge AND 
change-in-profit is neglarge THEN next- 
change-in -MaxUsers is neglarge. 

Rule 4: IF change-in-MaxUsers is poslarge AND 
change-in-profit is poslarge THEN next- 
change-in -MaxUsers is poslarge. 

The IF part determines the position on the profit 
curve, as well as the distance from the optimal point. 
For example, in Rule 4, if we increase MaxUsers and 
the profit increases, then we are to the left of the 
maximum. The THEN part indicates the suggested 
action. Again in Rule 4, we should continue to in¬ 
crease MaxUsers. Rule 2 and Rule 4 indicate the 
“correct” situations in that the profit is increasing. 
Conversely, Rule 1 and Rule 3 handle the “incor¬ 
rect actions,” where the previous action caused the 
profit to decrease. Since we do not know the actual 
MaxUsers value that maximizes the profit, these rules 
are easier to describe in terms of changes to the Max- 
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Users and profit values. This is why our controller 
architecture (Figure 6) uses du and dy. 

Afterwards, the consequents from all activated rules 
(with nonzero /x) are weighted (e.g., using the “cen¬ 
ter of gravity” method) to compute the appropriate 
adjustment to MaxUsers. 

Note that the above four rules are only given to 
illustrate the tuning concepts, whereas more com¬ 
plicated rule sets can be defined to have a finer 
definition of the linguistic values (e.g., neglarge , neg- 
med , negsmall , zero , possmall, posmed, poslarge) to 
increase the design flexibility, and to incorporate 
more knowledge such as how to get out of the flat 
saturation regions. Also worthy of mention is that 
for a typical tracking or regulation problem where 
the objective is to have zero control error, the in¬ 
puts of the controller usually include both error and 
change-in-error (similar to a PI controller, but note 
that the fuzzy controller output should be a “change,” 
which makes the fuzzy controller operate like a PI 
controller but with nonlinear operating functions). 
For the problem studied in this paper, the control 
objective is to achieve maximum profit. Since this 
maximum value is unknown in advance, the error 
(the difference between the current profit and the 
maximum profit) is also unknown and cannot be used 
as an input. Instead, we use change-in-MaxUsers and 
change-in-profit as control inputs, since they are both 
measurable. Our later stability analysis shows that 
the system can indeed be stabilized and the maxi¬ 
mum profit can be reached under this setting and 
with certain constraints. 

The use of fuzzy inference allows us to separate the 
logic of hill climbing from the calculation of values 
of MaxUsers. The rules encode the logic, and the 
membership function controls how profit and Max- 
Users are weighted and adjusted during fuzzy infer¬ 
ence. 

Evaluation. Under the fuzzy control architecture and 
fuzzy rule base introduced in the previous sections, 
the design includes selecting the control interval and 
choosing the scaling factors (normalizing gains) g du , 
g dy , and g m . We select a control interval of 10 min¬ 
utes because the profit data are not measured very 
frequently (e.g., by using the probing station). A large 
control interval also reduces the variability in the 
profit data and gives a more accurate measure. Next, 
the normalizing gains are tuned by trial and error 
in order to achieve good control performance. The 
tuning process can be guided by some heuristic 


knowledge of the target system and its dynamics. 
Generally, the larger the value of g du , the faster the 
control action, that is, the controller responds more 
quickly. However, too quick a control response may 
cause system oscillation as the controller overreacts 
to small variations in measurements. We choose 
g d u = Qm = 1/20 and g dy = 1/2 based on the sys¬ 
tem dynamics, considering that a change of 20 in 
MaxUsers or of 2 in profit are reasonably large. 

We compare the fuzzy controller with PI controller 
5 (Figure 3) that is tuned for a specific profit model 
(the response time constraint is 3 seconds) and a spe¬ 
cific workload (the mixed light and heavy workload 
as defined earlier). As Figures 8 and 9 show, the PI 
controller can generate good profits, whereas the 
fuzzy controller adjusts MaxUsers less rapidly, which 
results in lower profits. This is because the test sce¬ 
nario is exactly the same as that for which the PI con¬ 
troller is tuned. We would like to highlight that al¬ 
though the fuzzy controller is optimal in steady state, 
the current workload has several transients that the 
fuzzy controller (due to its slower reaction) does not 
handle as well as the Pi does. Also note that the Pi 
controller operates with a significantly smaller sam¬ 
pling interval (5 seconds) than the fuzzy controller 
(10 minutes). This is because the profit data have 
much more variability than the response time. In or¬ 
der to have a relatively smooth and accurate mea¬ 
sure of the profit, a larger sampling interval is nec¬ 
essary. This is also why the MaxUsers plot in Figure 
8 appears “smoother.” 

What happens if the profit model and/or workload 
changes? Figure 10 addresses this question by com¬ 
paring profits of PI 5 with those of the fuzzy control¬ 
ler. Three workloads are considered (as indicated 
at the top of each column). The profit model is also 
varied in that the rows represent different values of 
r, c, and the horizontal axis specifies W. For PI con¬ 
troller 5 we use K P = 2 and T l = 10 for all cases. 
The reference value depends on the profit model, 
and we use 1.5 for the profit model P(l), 2 for P(2), 
and 1 for P(3) (obtained according to trial and error 
for the case where W = 3). We do not redesign the 
fuzzy controller, which means we use the same nor¬ 
malizing gains g du = 20, g dy = 2, and# m = 20 and 
the same membership functions as indicated in Fig¬ 
ure 7 for all the simulation runs shown in Figure 10. 

The PI controller does well in the range of workload 
and W values for which it is trained. Otherwise, the 
fuzzy controller generally produces higher profits. 
Unlike selecting the reference value for the Pi con- 
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Figure 8 Behavior of PI controller 5 for profit model P(1) and l/l/=3 
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troller, the design process of the profit-based fuzzy 
controller is not affected by the selection of the profit 
model. Hence, it is more adaptable to various profit 
models (as illustrated in Figure 10 for different re¬ 
sponse time constraints). 

Stability and convergence analysis 

In this section, we show that the fuzzy controller is 
stable (i.e., all internal variables of the controller and 
the Notes server will not go to infinity) and converges 


to the maximum profit at steady state. Due to space 
limitation we provide only an outline of the proof. 
We begin by summarizing the dynamics of the sys¬ 
tem. Let u(k) denote the offset value of MaxUsers 
in the k th interval (the meaning of “offset” will be 
explained later), and m(k) denote the expected 
change of MaxUsers as a result of the output of the 
fuzzy controller. Then, from the previous section, we 
know that 

u(k + 1) = u{k) + m(k) (3) 
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Figure 9 Behavior of a fuzzy controller for profit model P(1) and l/l/=3 



y(k) = h(u(k )) (4) 

Equation 3 defines the relationship between Max- 
Users and the change in MaxUsers. Equation 4 de¬ 
fines the profit model. For convenience of deriva¬ 
tion, we assume that u(k) is the offset value of 
MaxUsers, that is, the difference between the mea¬ 
sured MaxUsers and the equilibrium point (so that 
when u = 0 ,y = h( 0) is the maximum profit). (Note 
that we use a similar offset concept as that in the sec¬ 
tion “Profit-based PI controller design,” but it is rel¬ 
ative to the equilibrium point for maximum profit 
rather than the operating point for linearization. Also 
note that this equilibrium is only used for the pur¬ 


pose of analysis and its value is not unknown to the 
fuzzy controller.) There is no loss of generality in 
doing so because any nonzero equilibrium point can 
be transformed to the origin via a change of vari¬ 
ables. With this assumption, we can determine the 
stability of the solution of the original system by 
studying the stability of the origin as an equilibrium 
point in the transformed system. 

In order to show the system convergence to the equi¬ 
librium point, we use the Lyapunov direct method. 26 
Consider the following Lyapunov function candidate 

V{u{k)) = u 2 {k) 
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Figure 10 Comparative behavior of the fuzzy controller and PI controller 5 



which characterizes the distance of the MaxUsers 
from its optimal value (noting that we use a change 
of variables to move the optimal value for u 0 to 0). 
If we can show that its difference 

V{u{k + 1)) — V{u{k)) = u 2 (k + 1) — u 2 (k) 

= \u(k) + m(k)] 2 — u 2 (k) 
= m(k)\2u{k) + m(k)] 

is always negative, then MaxUsers will converge to 
the value that maximizes profit. 


For convenience in notation, we define the previous 
adjustment of MaxUsers as du(k) = u(k ) — u(k — 
1). (Note that du(k) = m(k — 1).) Also, define the 
corresponding change of profit values as dy(k) = 
y(k ) - y(k - 1). Thus, our fuzzy rules imply that 

1. IF du(k ) < 0 AND dy(k) < 0 THEN m(k) > 0 

2. IF du (k) < 0 AND dy (k) > 0 THEN m (k) < 0 

3. IF du(k) > 0 AND dy(k) < 0 THEN m(k) < 0 

4. IF du(k) > 0 AND dy (k) > 0 THEN m(k) > 0 

Note that the above four relationships are repre¬ 
sented by the numeric variables, which are different 
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from those four fuzzy rules characterized by linguis¬ 
tic variables. For example, for a specific numeric in¬ 
put pair du = 0.3 and dy = 0.4, all four rules will 
be activated but with different certainties (comput¬ 
ed from the membership functions). They will give 
different weights to the consequents of each rule. 
Then, following center of gravity defuzzification, a 
crisp value can be obtained, which satisfies one of 
the above relationships (e.g., IF du = 0.3 > 0 and 
dy = 0.4 > 0 THEN m = 0.2731 > 0). These four 
relationships characterize certain properties of the 
nonlinear mapping that the fuzzy rules must observe 
in order to have a stable behavior. Besides this, the 
proper choice of membership functions and fuzzy 
rule set can improve the control performance, speed 
of convergence, and so on. 

Furthermore, the concave downward behavior of the 
profit model can be described as follows: 

if u(k) < 0 and du(k) < 0 then dy(k) < 0 

if u(k) < 0 and du(k) > 0 then dy(k) > 0 

IF u(k) > 0 AND du(k) < 0 then dy(k) > 0 

IF u(k)> 0 AND du(k) > 0 then dy(k) < 0 

The above relationships can be consolidated into 

IF u(k) > 0 then m(k) < 0 
IF u(k) < 0 then m(k) > 0 


optimal control, neither do we require any assump¬ 
tions on the arrival and service distributions. 

Conclusions 

The growing use of e-commerce is creating demand 
for SLAs with financial incentives in which service pro¬ 
vider revenues are determined by the number of 
completed transactions and there are penalties for 
SLA violations (e.g., exceeding response time guar¬ 
antees). Thus, situations are arising in which pro¬ 
viders must make trade-offs between losing revenue 
(e.g., as a result of admission control that denies ac¬ 
cess to some customers) and incurring penalties (e.g., 
because admitted work cannot be completed within 
the SLA-dictated response time). Making such 
choices is skill-intensive and time-consuming, and 
the decisions must be made in real time. This mo¬ 
tivates the use of profit-oriented feedback control. 
Unfortunately, the use of classical approaches, such 
as PI controllers, requires handcrafted construction 
for a specific workload and profit model. This is prob¬ 
lematic since workloads change frequently in e-com¬ 
merce environments, and profit models must often 
be adjusted as a result of SLA negotiations (which 
may be done automatically in Web service environ¬ 
ments). Herein, we propose using fuzzy control to 
maximize profits and study this approach using de¬ 
tailed simulations of a Lotus Notes e-mail server in 
which the MaxUsers parameter is dynamically ad¬ 
justed for admission control. 


Furthermore, we introduce a constraint \m(k)\ < 
21 u(k) to restrict the nonlinear surface of the fuzzy 
controller. Thus, if u(k) > 0 we have m(k) < 0 and 
2 u(k) > —m(k ), so that V(u(k + 1)) — V(u(k)) < 
0. Also, if u(k) < Owe have m(k) > 0 and 2 u(k) < 
— m(k ), so that V(u(k + 1)) — V(u(k )) < 0 as 
well. Therefore, u converges to its optimal value. 
Moreover, since 0 < a < 1, the system zero dynam¬ 
ics x(k + 1) = ax(k) are exponentially attractive 
as u = 0. Hence, x is also converging to its equi¬ 
librium point. 


Note that in the fuzzy controller we have introduced 
a constraint \m(k)\ <2\u(k)\. Since u(k) is obtained 
through a change of variable and u 0 is usually not 
known in advance, the value of u (k) may not be avail¬ 
able. Instead, we use a fixed constraint \m{k)\ < 2e 
where e is a small positive constant. Thus, for \u(k)\ 
> e , \m(k)\ < 2e leads to \m(k)\ < 2\u(k)\. This 
implies that u(k) will converge asymptotically to an 
e neighborhood of the equilibrium point. Note that 
we do not claim to have an optimal trajectory as in 


We propose a feedback control system that directly 
optimizes profits and is robust to changes in work¬ 
loads, the target system, and the underlying service 
level agreement (although the latter does need to 
be reflected in the feedback loop). A fuzzy control¬ 
ler is employed because of its simplicity and intu¬ 
itiveness. In particular for Lotus Notes, we argue that 
profits are concave downward in MaxUsers. This is 
a consequence of: (1) how MaxUsers affects response 
times and throughputs and (2) how these metrics af¬ 
fect profits. Hence, for a given workload and profit 
model, there is a unique value of MaxUsers that max¬ 
imizes profits. 

The foregoing suggests that hill climbing can be used 
to maximize profits at steady state. We construct a 
fuzzy controller to perform the hill climbing calcu¬ 
lations, and our design separates the logic of hill 
climbing (as expressed in fuzzy rules) from the cal¬ 
culation of new values of MaxUsers (as represented 
by the membership functions). Such a separation is 
desirable in order to deal with stochastics that make 
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profits quite “bumpy.” We prove that these rules con¬ 
verge to the maximum profit at steady state. Further, 
the fuzzy controller is unaffected by changes in work¬ 
load and profit model. 

Our detailed studies reveal that the fuzzy controller 
has lower profits than a PI controller that is hand¬ 
crafted for the specific workload and profit model. 
However, the fuzzy controller does at least as well 
as (and often much better than) the PI controller if 
we stray from the environment for which the PI con¬ 
troller is designed. This robustness, in combination 
with minimizing human intervention, may make the 
fuzzy controller economical to employ in practice. 

Two areas of future work are of particular interest. 
First, although we study Lotus Notes in this paper, 
the results obtained are almost certainly not specific 
to Notes. A seemingly easy generalization is to con¬ 
sider other systems with similar mechanisms for ad¬ 
mission control, such as the MaxClients parameter 
in the Apache Web server. Further generalizations 
may be possible as well, for example, to aid SLA ne¬ 
gotiation based on the availability of system service 
ability and user parameters. A second area of future 
work is the speed of convergence of the fuzzy con¬ 
troller. Our studies suggest that reducing conver¬ 
gence time of the fuzzy controller may improve its 
profits under dynamic workloads. The internal sys¬ 
tem measurements and their available historical data 
may be used to build the knowledge base and facil¬ 
itate on-line learning and optimization. 

Trademark or registered trademark of International Business 
Machines Corporation. 
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